On Fri, 2011-06-10 at 18:07 +0200, Jezz wrote:
> I recently upgraded SpamAssassin from 3.2.5 to 3.3.1, and I discovered that
> the JM_SOUGHT_FRAUD_x rules are now included within the official ruleset,
> within the 72_active.cf file.
>
> However, as far as I can tell, these rules seem to be different to the
> same-named rules that are within the latest copy of 20_sought_fraud.cf which
> is downloaded from the sought.rules.yerp.org channel. Which is to say, the
> contents of the 'meta' rule is different between these two files. My guess
> is that the version of these rules contained inside 72_active.cf is perhaps
> an older version than the ones inside 20_sought_fraud.cf. Is that the case?
Yes. Well, currently at least.
The Sought rule-set is re-generated multiple times a day, which is what
you get from the dedicated sa-update channel. With 3.3.x the plan is, to
frequently perform mass-checks and re-scoring, distributed via the
regular channel. This includes a recent snapshot of the Sought rules, so
the dedicated channel is almost obsolete. Alas, the re-scoring currently
does not happen as we plan for.
> What's more, I also see that these three FRAUD rules all have a score of 0
> inside 50_scores.cf. My first question then is why they are zeroed out?
It's a safety default. If you want the FRAUD subset, assign them a score
in your local config.
> Secondly, I'm wondering how I can enable these rules again if I do want to
> use them. In other words, if I want to use the latest version contained
> within 20_sought_fraud.cf - I don't see how this could be possible.
> Certainly I can add 'score' values for those three rules into my local.cf
> file, which will override the zeroed-out scores in 50_scores.cf file.
> However, because 72_active.cf comes numerically after 20_sought_fraud.cf,
> that means the (assumedly older) FRAUD rules inside 72_active.cf will
> override the (assumedly newer) FRAUD rules inside 20_sought_fraud.cf -
> right? If so, there's no way for me to use the rules from 20_sought_fraud.cf
> at all?
The score in your local config will take precedence, thus enabling the
rules.
You are generally correct about the numerical (actually lexical) order,
though it doesn't apply to the files you are talking about. The
mentioned 72_active and 20_sought are in different sa-update channels.
Now, the bad thing about this is that updates_spamassassin_org.cf is
lexically *after* sought_rules_yerp_org.cf in your rule update dir.
Which means the more recent rules in the dedicated Sought channel are
overwritten by the stock rules...
This merely requires a re-ordering hack, though. A symlink zzz_sought.cf
in your rule updates dir, pointing at the channel generated cf should
do. These channel cf files only hold include statements, to pull in the
actual cf files in the per-channel dir.
--
char *t="\10pse\0r\0dtu\0.@ghno\x4e\xc8\x79\xf4\xab\x51\x8a\x10\xf4\xf4\xc4";
main(){ char h,m=h=*t++,*x=t+2*h,c,i,l=*x,s=0; for (i=0;i<l;i++){ i%8? c<<=1:
(c=*++x); c&128 && (s+=h); if (!(h>>=1)||!t[s+h]){ putchar(t[s]);h=m;s=0; }}}
